How to report a vulnerability

Coordinated disclosure process, expected timelines, our PGP key, and safe-harbour statement.